Practical Mobile Forensics - Fourth Edition

Accessing a database using commercial tools

While a manual examination of iOS SQLite database files is possible with the use of free tools, most examiners prefer commercial support prior to digging manually into the files for examination. The following is an example of how to examine a database using SQLite, which is included in Belkasoft Evidence Center.

To open and analyze a database, you just need to follow a few simple steps, listed here:

1. Launch Belkasoft Evidence Center and navigate to View | SQLite Viewer, and choose the database file you want to examine.
2. Once the database is chosen, it's immediately opened with SQLite Viewer and is ready to be examined, as illustrated in the following screenshot:

sms.db database opened with Belkasoft ...